At healthcare events throughout the world, we have met many health tech companies who are considering migrating to the cloud, but have serious concerns about protecting electronic protected health Information (e-PHI) and maintaining HIPAA compliance as they virtualize their environments.

We are seeing a serious gap between healthcare companies’ security and compliance needs, and the solutions offered by their cloud providers.

Below, a summary of the questions we are continually asked at shows, events, and meetings with healthcare professionals.

Cloud Computing Security Considerations

Q. What cloud computing security considerations should healthcare companies examine?HIPAA compliance is comprised of multiple technologies and processes. When it comes to data encryption, securing e-PHI that your company creates, receives, maintains or transmits electronically is critical in infrastructure clouds. Clouds obviously don’t have walls – which is why encryption has become the best practice for creating “mathematical walls” in the cloud.

Since your cloud project will have both servers and data in the cloud, you need a solution that:

Has an “everything cloud” approach: No “gateways” or hardware required

Maintains HIPAA/HITECH Compliance

Ensures data security – going beyond a “check the box” approach

Is simple, easy to use, flexible, and cost-effective

It is your responsibility to secure your sensitive patient data, to encrypt data at rest and in transit and, importantly, to ensure that only you (not even your cloud provider) control your encryption keys. This is both security common sense and also important from a regulatory point of view.

Q. Is it possible to achieve “safe harbor” in cloud scenarios?The Secretary of Health and Human Services published guidance on “technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.” The guidance emphasizes that data encryption is not only a best practice for protecting privacy and security – it also provides a safe harbor to the organization in case of data loss.

Q. How is the Porticor cloud encryption solution different?Porticor did not re-invent the data encryption wheel. We use the strongest industry standards for data encryption like AES. Our system is unique, however, in how it handles the keys to your encrypted data. Porticor is the only system that keeps control of encryption keys in the hands of the end customer while providing a pure cloud model – without any hardware requirements.

With Porticor, once your e-PHI is encrypted, our system splits the encryption key it into two parts (here’s how in 90 seconds). One part stays within our system and one part, the “master key” stays with you at all times. Both parts are required to access your data. With this split-key encryption approach, Porticor ensures that only you control access to your data. Your cloud provider cannot access it, Porticor cannot access it, and hackers cannot access it. Only you control your data. This is what makes the system HIPAA compliant while maintaining the “pure cloud” approach. You can read more about it here.

Q. Does this kind of cloud security slow down performance?No. We’ve gone to some length to keep performance top notch, by introducing efficient streaming. We also make sure that encryption happens inside your cloud account so there are no latency issues around network hops. You have a choice between a “Virtual Appliance” that you can bring up inside your own cloud account, and an “agent” that you can install on your own.

As a result in some use cases we actually speed you up a bit! Detailed benchmarks are available here.

Q. What does homomorphic encryption mean?Homomorphic encryption is a technique that enables encrypting data, and keeping it encrypted even if it is used in calculations. As it relates to our system, Porticor homomorphically encrypts your master key before it enters the cloud, and it stays encrypted – never decrypted – when it is used in the cloud. This means your entire project works without anyone knowing your master key – not Porticor, not AWS, no computing element at all. This way, you retain control of your key at all times. Your key is safe even when it is in use in the cloud.

Q. Which companies need Porticor’s cloud security?If your company or its clients face regulations like HIPAA, PCI DSS, or many others – you need Porticor.

Q. Which clouds are supported by Porticor?You can use Porticor in any cloud scenario: public clouds (AWS, VMware, IBM, HP, etc.), private clouds (VMware again), or hybrid scenarios.

Q. How do I get started?You can try it for free here. If you have any questions, contact us.

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

Virtual Application Appliances (VAA) decouple an application from the operating system (OS) and its underlying infrastructure. The resultant virtual application appliance contains an application with its dependencies, but with zero operating system (zeOS) component. The aim of VAAs is to enable enterprises to provision server based applications to any machine in the data center in a matter of seconds or move an application from the data center to the cloud (D2C).

Cloud Expo

Cloud Computing & All That
It Touches In One Location Cloud Computing - Big Data - Internet of Things
SDDC - WebRTC - DevOps
Cloud computing is become a norm within enterprise IT.

The competition among public cloud providers is red hot, private cloud continues to grab increasing shares of IT budgets, and hybrid cloud strategies are beginning to conquer the enterprise IT world.

Big Data is driving dramatic leaps in resource requirements and capabilities, and now the Internet of Things promises an exponential leap in the size of the Internet and Worldwide Web.

The world of SDX now encompasses Software-Defined Data Centers (SDDCs) as the technology world prepares for the Zettabyte Age.

Add the key topics of WebRTC and DevOps into the mix, and you have three days of pure cloud computing that you simply cannot miss.

Delegates will leave Cloud Expo with dramatically increased understanding the entire scope of the entire cloud computing spectrum from storage to security.

Cloud Expo - the world's most established event - offers a vast selection of 130+ technical and strategic Industry Keynotes, General Sessions, Breakout Sessions, and signature Power Panels. The exhibition floor features 100+ exhibitors offering specific solutions and comprehensive strategies. The floor also features two Demo Theaters that give delegates the opportunity to get even closer to the technology they want to see and the people who offer it.

Attend Cloud Expo. Craft your own custom experience. Learn the latest from the world's best technologists. Find the vendors you want and put them to the test.